The driver will be the component that runs the program being fuzzed.  The driver
should start the program, feed in the input, and determine when the program is
done processing the input.  This component may need to be customized per
target application.

\par
Anything which is driver specific will only be used within the driver functions.
All other components will treat these items as opaque strings/blobs.


\api{void * create(char * options, instrumentation\_t * instrumentation,
void * instrumentation\_state, mutator\_t * mutator, void * mutator\_state)
}{
This function will allocate and initialize the driver structures.  If the driver
is going to be testing a long-running process, this function should start that
process.  Anything that needs to be done before a fuzzing run can start should
be done here.
}{
\item options - a JSON string that contains the driver specific string of
options.
\item instrumentation - a pointer to an instrumentation instance that the driver
will use to instrument the requested program.  The caller should initialize this
instrumentation instance before the create call to the driver, and then free it
after cleaning up the driver.  This parameter is optional and can be set to NULL
if the caller does not wish to use an instrumentation with the driver.
\item instrumentation\_state - a pointer to the instrumentation state for the
passed in instrumentation.  This parameter is optional and can be set to NULL
if the caller does not wish to use an instrumentation with the driver.
\item mutator - a pointer to a mutator instance that the driver can use to
obtain the next input (for use in the \texttt{test\_next\_input} function).
This parameter is optional and can be set to NULL if the caller does not wish to
use a mutator with the driver.  Without this parameter, the
\texttt{test\_next\_input} and \texttt{get\_last\_input} functions will be
unavailable.
\item mutator\_state - a pointer to the mutator state for the passed in mutator.
This parameter is optional and can be set to NULL if the caller does not wish to
use a mutator with the driver.
\item return value - a driver specific structure or NULL on failure.  The
returned value should not be used for anything other than passing to the various
Driver API functions.
}

\api{void cleanup(void * driver\_state)
}{
This function will kill any processes created by the driver and clean up
anything else that was created to help fuzzing.  It will also free the driver
state.
}{
\item driver\_state - a driver specific structure previously created by the
create function.  This structure will be freed and should not be referenced
afterwards.
}

\api{int test\_input(void * driver\_state, char * buffer, size\_t length)
}{
This function will cause the program being fuzzed to be tested against the given
input.  This function should block execution until the program being fuzzed has
finished processing the given input.
}{
\item driver\_state - a driver specific structure previously created by the
create function.
\item buffer -  the input that should be tested
\item length - the length of the buffer argument
\item return value - 0 on success, -1 on failure
}

\api{int test\_next\_input(void * driver\_state);
}{
This function uses the mutator given during the driver creation to retrieve the
next mutated input and test it against the target program.  This function blocks
execution until the program being fuzzed has finished processing the mutated
input. It will report whether the fuzzed process crashed or hung, or neither.
This function is only available if a mutator was given to the driver in the
\texttt{create} function.
}{
\item driver\_state - a driver specific structure previously created by the
create function.
\item return value - 0 on success, -1 on failure, or -2 if the mutator has run
out of inputs to to mutate.
}

\api{void * get\_last\_input(void * driver\_state, int * length);
}{
This function retrieves the most recent mutated input that was tested with the
\texttt{test\_next\_input} function.  This function is only available if a
mutator was given to the driver in the \texttt{create} function.
}{
\item driver\_state - a driver specific structure previously created by the
create function.
\item length - a pointer to an integer that will be set to the length of the
returned buffer.
\item return value - on success this function will return a buffer containing
the last input that was tested, or NULL on failure.  This pointer should not be
freed by the caller, and is only valid until the next call to
\texttt{test\_next\_input}.
}


\api{int help(char ** help\_str)
}{
This function sets a help message for the driver. This is useful if the driver
takes a JSON options string in the create() function.
}{
\item help\_str - A double pointer that will be updated to point to the new help
string.
\item return value - 0 on success and -1 on failure
}
